What is the CVSS score of CVE-2025-68109?

CVE-2025-68109 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 1.5%.

Which versions of ChurchCRM are affected by CVE-2025-68109?

ChurchCRM deployments used for member and donor management are exposed to remote code execution through an authenticated administrator workflow, which could allow a malicious or compromised admin…

Is there a public PoC exploit available for CVE-2025-68109?

Yes, a public proof-of-concept exploit is available for CVE-2025-68109. Prioritise patching immediately. EPSS: 1.5%.

How to fix or mitigate CVE-2025-68109?

Within 24 hours, confirm whether your organization runs ChurchCRM prior to 6.5.3, inventory administrative accounts, enable MFA, and temporarily restrict or disable the Database Restore function for non-essential administrators. Within 7 days, upgrade all affected ChurchCRM instances to 6.5.3 (Vendor-released patch: 6.5.3), validate that .htaccess uploads are blocked, and review web-accessible directories for unauthorized PHP or shell files. Within 30 days, complete a full audit of administrative access, enforce least privilege and session logging, and add file-integrity monitoring or WAF rules to detect and block web shell uploads and execution.

ChurchCRM CVE-2025-68109

HIGH

OS Command Injection (CWE-78)

2025-12-17 security-advisories@github.com

PHP RCE Command Injection Churchcrm

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Admin-only Database Restore feature justifies PR:H; network-reachable upload with low complexity and no victim interaction yields total RCE impact (C/I/A:H).

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Metadata Corrected

Oct 01, 2026 - 16:40 vuln.today

tag: PHP added

Analysis Generated

Oct 01, 2026 - 16:32 vuln.today

CVE Published

Dec 17, 2025 - 22:16 nvd

HIGH 7.2

DescriptionNVD

ChurchCRM is an open-source church management system. In versions prior to 6.5.3, the Database Restore functionality does not validate the content or file extension of uploaded files. As a result, an attacker can upload a web shell file and subsequently upload a .htaccess file to enable direct access to it. Once accessed, the uploaded web shell allows remote code execution (RCE) on the server. Version 6.5.3 fixes the issue.

AnalysisAI

Remote code execution in ChurchCRM versions prior to 6.5.3 allows an authenticated administrator to upload a web shell through the Database Restore function, then upload a .htaccess file to make the shell directly accessible and executable. The flaw is tracked as CVE-2025-68109 with CVSS 3.1 base score 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H); the high PR:H metric reflects that the vulnerable restore feature is administrative. Publicly available exploit code exists, but there is no confirmed active exploitation (CISA KEV) in the provided data, and upgrading to 6.5.3 remediates the issue.

Technical ContextAI

ChurchCRM is an open-source church management system. Its Database Restore functionality accepts uploaded files without validating their content or extension, which is rooted in the CWE-78 command-injection class because the attacker ultimately achieves OS command execution through a web shell. In practice, the attacker uploads a script and a .htaccess file; exploitation depends on the web server honoring per-directory .htaccess overrides (for example, Apache with AllowOverride enabled) and allowing execution of the uploaded script. The provided CPE cpe:2.3:a:churchcrm:churchcrm:*:*:*:*:*:*:*:* covers ChurchCRM releases before 6.5.3, and the GitHub advisory GHSA-pqm7-g8px-9r77 is the upstream reference.

RemediationAI

Vendor-released patch: upgrade to ChurchCRM 6.5.3 or later; the fix is documented in GitHub advisory GHSA-pqm7-g8px-9r77 (https://github.com/ChurchCRM/CRM/security/advisories/GHSA-pqm7-g8px-9r77). If immediate upgrade is not possible, restrict Database Restore access to trusted administrator accounts only, since exploitation requires an authenticated admin-level session; consider temporarily disabling or removing the restore feature if it is not operationally needed. Harden the web server by disabling .htaccess overrides in upload directories or otherwise preventing uploaded scripts from being directly requested and executed; these compensating controls can break legitimate restore workflows and may require tuning to avoid blocking valid .htaccess use elsewhere. No vendor patch version other than 6.5.3 should be cited from the available data.